PIP Install - Week 2 - Magnet Weekly CTF


We are gonna use the Android Image that we examined last week for the “file that maps IPs to names recently accessed”. You can download the image here.

Week 2 challenge is involved on applications capability and application usage. Let us get started!

Description

What domain was most recently viewed via an app that has picture-in-picture capability?

For this weeks challenge, I am gonna use Alexis Brignoni’s ALEAPP.

Initial Analysis

During the announcement of Week 2 challenge it was mentioned about a webinar that Tarah Melton and Jessica Hyde had early this year on different data that can be found in Google Takeout and an Android Image. In the end of the webinar Jessica Hyde show us that, when we change an application the snapshots will be stored on the device.

And I found a site that listed out all the applications that supported Picture In Picture capability, and it turned out only a few have it.

Firing up ALEAPP

On firing Up ALEAPP, it creates a nice HTML report in the mentioned directory mentioned.

On going through the reports generated by ALEAPP, it created a report for “Recent Activity, Snanpshots”. And the last accessed UPL from the browser according to the snapshot is http://malliesae[.]com/investor-page/.

From my personal experience, Chrome supports Picture In Picture capability, And on checking the Chrome History report generated by ALEAPP and sorting it out to most recently accessed URLs, it gave http://malliesae[.]com/investor-page/ accessed at 2020-03-23 23:53:22

As chrome is having PIP capability and malliesae[.]com is the most recently accessed domain, let head on to submit it. And its correct!

Flag

malliesae.com


Author: Nihith
Reprint policy: All articles in this blog are used except for special statements CC BY 4.0 reprint polocy. If reproduced, please indicate source Nihith !
  TOC